Examples with SecurityToken org.apache.cxf.ws.security.tokenstore.SecurityToken used on opensource projects

Example 76 with SecurityToken

use of org.apache.cxf.ws.security.tokenstore.SecurityToken in project cxf by apache.

the class SymmetricBindingHandler method getUTDerivedKey.

private SecurityToken getUTDerivedKey() throws WSSecurityException {
    List<WSHandlerResult> results = CastUtils.cast((List<?>) message.getExchange().getInMessage().get(WSHandlerConstants.RECV_RESULTS));
    for (WSHandlerResult rResult : results) {
        List<WSSecurityEngineResult> wsSecEngineResults = rResult.getActionResults().get(WSConstants.UT_NOPASSWORD);
        if (wsSecEngineResults != null) {
            for (WSSecurityEngineResult wser : wsSecEngineResults) {
                String utID = (String) wser.get(WSSecurityEngineResult.TAG_ID);
                if (utID == null || utID.length() == 0) {
                    utID = wssConfig.getIdAllocator().createId("UsernameToken-", null);
                }
                Instant created = Instant.now();
                Instant expires = created.plusSeconds(WSS4JUtils.getSecurityTokenLifetime(message) / 1000L);
                SecurityToken securityToken = new SecurityToken(utID, created, expires);
                byte[] secret = (byte[]) wser.get(WSSecurityEngineResult.TAG_SECRET);
                securityToken.setSecret(secret);
                return securityToken;
            }
        }
    }
    return null;
}

Example 77 with SecurityToken

use of org.apache.cxf.ws.security.tokenstore.SecurityToken in project cxf by apache.

the class SymmetricBindingHandler method setupUTDerivedKey.

private String setupUTDerivedKey(UsernameToken sigToken) throws WSSecurityException {
    boolean useMac = hasSignedPartsOrElements();
    WSSecUsernameToken usernameToken = addDKUsernameToken(sigToken, useMac);
    String id = usernameToken.getId();
    byte[] secret = usernameToken.getDerivedKey();
    Instant created = Instant.now();
    Instant expires = created.plusSeconds(WSS4JUtils.getSecurityTokenLifetime(message) / 1000L);
    SecurityToken tempTok = new SecurityToken(id, usernameToken.getUsernameTokenElement(), created, expires);
    tempTok.setSecret(secret);
    tokenStore.add(tempTok);
    return id;
}

Example 78 with SecurityToken

use of org.apache.cxf.ws.security.tokenstore.SecurityToken in project cxf by apache.

the class TransportBindingHandler method doIssuedTokenSignature.

private byte[] doIssuedTokenSignature(final AbstractToken token, final SupportingTokens wrapper) throws Exception {
    boolean tokenIncluded = false;
    // Get the issued token
    SecurityToken secTok = getSecurityToken();
    if (secTok == null) {
        LOG.fine("The retrieved SecurityToken was null");
        Exception ex = new Exception("The retrieved SecurityToken was null");
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, ex);
    }
    if (isTokenRequired(token.getIncludeTokenType())) {
        // Add the token
        Element el = cloneElement(secTok.getToken());
        // if (securityTok != null) {
        // do we need to sign this as well?
        // String id = addWsuIdToElement(el);
        // sigParts.add(new WSEncryptionPart(id));
        // }
        addEncryptedKeyElement(el);
        tokenIncluded = true;
    }
    List<WSEncryptionPart> sigParts = signPartsAndElements(wrapper.getSignedParts(), wrapper.getSignedElements());
    if (token.getDerivedKeys() == DerivedKeys.RequireDerivedKeys) {
        return doDerivedKeySignature(tokenIncluded, secTok, token, sigParts);
    }
    return doSignature(tokenIncluded, secTok, token, wrapper, sigParts);
}

Example 79 with SecurityToken

use of org.apache.cxf.ws.security.tokenstore.SecurityToken in project cxf by apache.

the class TransportBindingHandler method handleBinding.

public void handleBinding() {
    WSSecTimestamp timestamp = createTimestamp();
    handleLayout(timestamp);
    try {
        if (this.isRequestor()) {
            TransportToken transportTokenWrapper = tbinding.getTransportToken();
            if (transportTokenWrapper != null) {
                AbstractToken transportToken = transportTokenWrapper.getToken();
                if (transportToken instanceof IssuedToken) {
                    SecurityToken secToken = getSecurityToken();
                    if (secToken == null) {
                        unassertPolicy(transportToken, "No transport token id");
                        return;
                    }
                    assertPolicy(transportToken);
                    if (isTokenRequired(transportToken.getIncludeTokenType())) {
                        Element el = secToken.getToken();
                        addEncryptedKeyElement(cloneElement(el));
                    }
                }
                assertToken(transportToken);
                assertTokenWrapper(transportTokenWrapper);
            }
            handleNonEndorsingSupportingTokens();
            if (transportTokenWrapper != null) {
                handleEndorsingSupportingTokens();
            }
        } else {
            handleNonEndorsingSupportingTokens();
            if (tbinding != null && tbinding.getTransportToken() != null) {
                assertTokenWrapper(tbinding.getTransportToken());
                assertToken(tbinding.getTransportToken().getToken());
                handleEndorsingSupportingTokens();
            }
            addSignatureConfirmation(null);
        }
    } catch (Exception e) {
        LOG.log(Level.FINE, e.getMessage(), e);
        throw new Fault(e);
    }
    if (tbinding != null) {
        assertPolicy(tbinding.getName());
        assertAlgorithmSuite(tbinding.getAlgorithmSuite());
        assertWSSProperties(tbinding.getName().getNamespaceURI());
        assertTrustProperties(tbinding.getName().getNamespaceURI());
    }
    assertPolicy(SP12Constants.SIGNED_PARTS);
    assertPolicy(SP11Constants.SIGNED_PARTS);
    assertPolicy(SP12Constants.ENCRYPTED_PARTS);
    assertPolicy(SP11Constants.ENCRYPTED_PARTS);
}

Example 80 with SecurityToken

use of org.apache.cxf.ws.security.tokenstore.SecurityToken in project cxf by apache.

the class KerberosTokenPolicyValidator method validatePolicies.

/**
 * Validate policies.
 */
public void validatePolicies(PolicyValidatorParameters parameters, Collection<AssertionInfo> ais) {
    List<WSSecurityEngineResult> kerberosResults = findKerberosResults(parameters.getResults().getActionResults().get(WSConstants.BST));
    for (WSSecurityEngineResult kerberosResult : kerberosResults) {
        KerberosSecurity kerberosToken = (KerberosSecurity) kerberosResult.get(WSSecurityEngineResult.TAG_BINARY_SECURITY_TOKEN);
        boolean asserted = true;
        for (AssertionInfo ai : ais) {
            KerberosToken kerberosTokenPolicy = (KerberosToken) ai.getAssertion();
            ai.setAsserted(true);
            assertToken(kerberosTokenPolicy, parameters.getAssertionInfoMap());
            if (!isTokenRequired(kerberosTokenPolicy, parameters.getMessage())) {
                PolicyUtils.assertPolicy(parameters.getAssertionInfoMap(), new QName(kerberosTokenPolicy.getVersion().getNamespace(), "WssKerberosV5ApReqToken11"));
                PolicyUtils.assertPolicy(parameters.getAssertionInfoMap(), new QName(kerberosTokenPolicy.getVersion().getNamespace(), "WssGssKerberosV5ApReqToken11"));
                continue;
            }
            if (!checkToken(parameters.getAssertionInfoMap(), kerberosTokenPolicy, kerberosToken)) {
                asserted = false;
                ai.setNotAsserted("An incorrect Kerberos Token Type is detected");
                continue;
            }
        }
        if (asserted) {
            SecurityToken token = createSecurityToken(kerberosToken);
            token.setSecret((byte[]) kerberosResult.get(WSSecurityEngineResult.TAG_SECRET));
            TokenStoreUtils.getTokenStore(parameters.getMessage()).add(token);
            parameters.getMessage().getExchange().put(SecurityConstants.TOKEN_ID, token.getId());
            return;
        }
    }
}